[UNVETTED AI SLOP]

  1. Wire.API.Team.Member: Removed isFullTeamMember (export + definition) — it was a temporary placeholder for the behavior change.
  2. ensureAccessRole (Util.hs): Changed guard from maybe True (not . isFullTeamMember) . snd → isNothing . snd. Collaborators (Just (Left _)) now pass the TeamMemberAccessRole check, just like full members.
  3. ensureConversationAccess (Util.hs): Now uses lookupTeamPrincipal instead of internalGetTeamMember + fmap Right, so collaborators get Just (Left _) instead of Nothing and pass the access role check. Added Member TeamCollaboratorsSubsystem r constraint.
  4. convLocalMemberships (CreateInternal.hs): Now uses lookupTeamPrincipal for all users. The notTeamMember call is replaced with [uid | (uid, Nothing) <- allUsersWithPrincipal], exempting collaborators from the explicit connection check.
  5. checkLocals (Action.hs): Now batch-fetches collaborators via internalGetTeamCollaboratorsWithIds and merges them with team members into the userMembershipMap, so collaborators appear as Just (Left _) and pass the access role check.

Author: fisx

libs/wire-api/src/Wire/API/Team/Member.hs

@@ -74,7 +74,6 @@ module Wire.API.Team.Member
 
     -- * TeamPrincipal
     TeamPrincipal,
-    isFullTeamMember,
   )
 where
 
@@ -667,16 +666,6 @@ collaboratorToTeamPermissions =
 -- @Left@ case.
 type TeamPrincipal = Either TeamCollaborator TeamMember
 
--- | True only for full team members, not for collaborators.
--- Used in conversation access-role checks that enforce team-member-only
--- conversations, preserving the invariant that collaborators are not
--- considered equivalent to full members for access control.
---
--- (We probably do not want to discriminate against collaborators in
--- this way, but that's a semantic change for another PR.)
-isFullTeamMember :: TeamPrincipal -> Bool
-isFullTeamMember = isRight
-
 ----------------------------------------------------------------------
 
 makeLenses ''TeamMember'

libs/wire-subsystems/src/Wire/ConversationSubsystem/Action.hs

@@ -136,6 +136,7 @@ import Wire.Sem.Now qualified as Now
 import Wire.Sem.Random (Random)
 import Wire.StoredConversation
 import Wire.StoredConversation qualified as Data
+import Wire.API.Team.Collaborator (TeamCollaborator (..))
 import Wire.TeamCollaboratorsSubsystem
 import Wire.TeamStore
 import Wire.TeamSubsystem (ConsentGiven (..), TeamSubsystem, consentGiven)
@@ -794,8 +795,14 @@ performConversationJoin qusr lconv (ConversationJoin invited role joinType) = do
       tms <-
         Map.fromList . map (view Wire.API.Team.Member.userId &&& Imports.id)
           <$> TeamSubsystem.internalSelectTeamMembers tid newUsers
-      let userMembershipMap = map (Imports.id &&& (fmap Right . flip Map.lookup tms)) newUsers
-       in ensureAccessRole (convAccessRoles conv) userMembershipMap
+      collabs <-
+        Map.fromList . map (\c -> (c.gUser, c))
+          <$> internalGetTeamCollaboratorsWithIds (Set.singleton tid) (Set.fromList newUsers)
+      let principalFor uid =
+            fmap Right (Map.lookup uid tms)
+              <|> fmap Left (Map.lookup uid collabs)
+          userMembershipMap = map (Imports.id &&& principalFor) newUsers
+      ensureAccessRole (convAccessRoles conv) userMembershipMap
       ensureConnectedToLocalsOrSameTeam lusr newUsers
     checkLocals lusr Nothing newUsers = do
       ensureAccessRole (convAccessRoles conv) (map (,Nothing) newUsers)

libs/wire-subsystems/src/Wire/ConversationSubsystem/CreateInternal.hs

@@ -55,7 +55,6 @@ import Wire.API.Team
 import Wire.API.Team.Collaborator qualified as CollaboratorPermission
 import Wire.API.Team.Feature
 import Wire.API.Team.Feature qualified as Conf
-import Wire.API.Team.FeatureFlags (notTeamMember)
 import Wire.API.Team.LegalHold (LegalholdProtectee (LegalholdPlusFederationNotImplemented))
 import Wire.API.Team.Member
 import Wire.API.Team.Permission hiding (self)
@@ -343,9 +342,10 @@ checkCreateConvPermissions lusr newConv (Just tinfo) allUsers = do
     GroupConversation -> checkGroup
     MeetingConversation -> checkGroup
 
-  convLocalMemberships <- mapM (flip TeamSubsystem.internalGetTeamMember convTeam) (ulLocals allUsers)
-  ensureAccessRole (accessRoles newConv) (zip (ulLocals allUsers) (fmap (fmap Right) convLocalMemberships))
-  ensureConnectedToLocals (tUnqualified lusr) (notTeamMember (ulLocals allUsers) (catMaybes convLocalMemberships))
+  convLocalMemberships <- mapM (TeamSubsystem.lookupTeamPrincipal convTeam) (ulLocals allUsers)
+  let allUsersWithPrincipal = zip (ulLocals allUsers) convLocalMemberships
+  ensureAccessRole (accessRoles newConv) allUsersWithPrincipal
+  ensureConnectedToLocals (tUnqualified lusr) [uid | (uid, Nothing) <- allUsersWithPrincipal]
   ensureConnectedToRemotes lusr (ulRemotes allUsers)
   where
     ensureCreateChannelPermissions ::

libs/wire-subsystems/src/Wire/ConversationSubsystem/Query.hs

@@ -648,6 +648,7 @@ getConversationByReusableCode ::
     Member FeaturesConfigSubsystem r,
     Member HashPassword r,
     Member RateLimit r,
+    Member TeamCollaboratorsSubsystem r,
     Member TeamSubsystem r
   ) =>
   Local UserId ->

libs/wire-subsystems/src/Wire/ConversationSubsystem/Update.hs

@@ -741,6 +741,7 @@ joinConversationByReusableCode ::
     Member FeaturesConfigSubsystem r,
     Member HashPassword r,
     Member RateLimit r,
+    Member TeamCollaboratorsSubsystem r,
     Member TeamSubsystem r,
     Member Now r,
     Member (Input ConversationSubsystemConfig) r
@@ -770,6 +771,7 @@ joinConversationById ::
     Member NotificationSubsystem r,
     Member E.ExternalAccess r,
     Member Now r,
+    Member TeamCollaboratorsSubsystem r,
     Member TeamSubsystem r
   ) =>
   Local UserId ->
@@ -794,6 +796,7 @@ joinConversation ::
     Member ConversationStore r,
     Member Now r,
     Member NotificationSubsystem r,
+    Member TeamCollaboratorsSubsystem r,
     Member TeamSubsystem r
   ) =>
   Local UserId ->

libs/wire-subsystems/src/Wire/ConversationSubsystem/Util.hs

@@ -120,7 +120,7 @@ ensureAccessRole ::
 ensureAccessRole roles users = do
   when (Set.null roles) $ throwS @'ConvAccessDenied
   unless (NonTeamMemberAccessRole `Set.member` roles) $
-    when (any (maybe True (not . isFullTeamMember) . snd) users) $
+    when (any (isNothing . snd) users) $
       throwS @'NotATeamMember
   unless (Set.fromList [GuestAccessRole, ServiceAccessRole] `Set.isSubsetOf` roles) $ do
     activated <- lookupActivatedUsers (fst <$> users)
@@ -676,6 +676,7 @@ ensureConversationAccess ::
   ( Member BrigAPIAccess r,
     Member (ErrorS 'ConvAccessDenied) r,
     Member (ErrorS 'NotATeamMember) r,
+    Member TeamCollaboratorsSubsystem r,
     Member TeamSubsystem r
   ) =>
   UserId ->
@@ -684,8 +685,8 @@ ensureConversationAccess ::
   Sem r ()
 ensureConversationAccess zusr conv access = do
   ensureAccess conv access
-  zusrMembership <- maybe (pure Nothing) (TeamSubsystem.internalGetTeamMember zusr) (Data.convTeam conv)
-  ensureAccessRole (Data.convAccessRoles conv) [(zusr, fmap Right zusrMembership)]
+  zusrPrincipal <- maybe (pure Nothing) (\tid -> TeamSubsystem.lookupTeamPrincipal tid zusr) (Data.convTeam conv)
+  ensureAccessRole (Data.convAccessRoles conv) [(zusr, zusrPrincipal)]
 
 ensureAccess ::
   (Member (ErrorS 'ConvAccessDenied) r) =>